Playcall privacy

Last updated August 4, 2026.

Playcall reads the business data you connect and turns it into a working board: tasks, a morning brief, and reviews. This page says exactly what is read, what is stored, and what never leaves. If anything here changes, this page changes first.

Signing in

You sign in with Google. Playcall receives your email address and stores it with an account id derived from it. Playcall never sees your Google password, and sign-in on its own grants no access to your mail, calendar, or files.

What each connected stream reads

Every stream is optional, connected by you, and read-only. Playcall never writes to, sends from, or changes anything in a connected account.

• Gmail. Read-only. Playcall reads message headers (sender, subject, dates) from your inbox and Sent mail from the last 14 days. The text of recent messages from real people is read by an automated classifier whose only output is a category and an urgency; message text is never stored, never shown to anyone, and never used to write board content. Attachments are never opened. Playcall cannot send, delete, or label mail: the access scope Google grants does not allow it.
• Google Calendar. Read-only. Playcall reads your calendar list and events on the calendars you keep selected, from the last 7 days and the next 7: times, titles, and whether guests are invited. It stores derived numbers (booked hours, open hours, event counts), not your events.
• Stripe. Read-only, via a restricted key you create. Playcall reads balances, charges, and subscription state and stores derived revenue numbers.
• Google Analytics and Search Console. Read-only aggregate traffic and search numbers for the one property you share.
• GitHub. Read-only activity on the one repository you pick: commit counts and recency, not code.
• Reddit. Public threads matching keywords you choose. Playcall never posts.
• Linear. Read-only issues for the one team you pick.
• Discord. Messages in the specific channels you pick on your own server, to surface community questions. Never direct messages.

How credentials are kept

Connection credentials (tokens, keys, app passwords) are encrypted at rest, are never shown back to you or anyone else, and travel only to the provider they belong to. Disconnecting a stream deletes its credential the same moment.

AI processing

Playcall's judgment runs on Anthropic's Claude models. Derived business signals (counts, amounts, capped subject lines from your inbox) are sent to Anthropic's API to draft your tasks and briefs. Anthropic does not train on this API traffic under its commercial terms.

Who your data reaches

Two parties, both processors acting on Playcall's instructions, neither free to use your data for their own purposes:

• Our hosting provider (Railway). Stores the server and its encrypted data volume.
• Anthropic. Receives the derived signals described above to generate your tasks and briefs.

Your data is never sold, never transferred to data brokers or advertisers, and never shared with anyone else except where the law requires it.

How long we keep it

Playcall does not archive your mail or your calendar. Each scan reads a rolling window from the provider (the last 14 days of email, 7 days back and 7 days forward for calendar) and keeps only what it derives: counts, amounts, hours, and the cards written from them. Message bodies are discarded the moment the classifier returns. Subject text, where it is kept at all, is capped at 120 characters and lives only on the card that cites it.

What Playcall does keep, it keeps while your account exists: your board, your cards, your signals, your settings, and your outcome log. Retention is tied to the account, not to a timer.

Deleting your data

• A stream. Disconnect it in Settings. Its credential is deleted the same moment, and Playcall stops reading it.
• Your board. Reset it in Settings. Cards, signals, and derived numbers are cleared. One recovery snapshot is held so a reset made by mistake can be undone; it is removed when you delete your account, or sooner if you ask.
• Everything. Delete your account in Settings, under Data. It takes effect the same moment; one recovery copy is held for 30 days in case the deletion was a mistake, then nothing. No copy is kept after that. Asking at the address below works the same way.

Revoking Playcall's access from your Google account permissions page cuts off Google data immediately, at any time, without going through us.

Google API disclosure

Playcall's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is never used for advertising, never sold or transferred to data brokers, and never used to create, train, or improve generalized AI or machine learning models.

Your data

Your board, signals, and settings belong to you. You can export them or erase them from Settings at any time; erasing removes your stored data and credentials from the server. Questions or removal requests: team@getmoonbounce.com.